The posting
RecoTek is Reconomy’s new centralized technology hub located in Bucharest, Romania, officially launched in February 2024. Serving as the backbone of Reconomy’s tech operations, it consolidates inhouse expertise across all Reconomy brands to accelerate platform development and enhance service delivery.
Reconomy is an international circular economy specialist that combines technology, skills and incredible people to enable businesses to better manage their resources, helping reduce waste, optimise their supply chains, and contribute in a meaningful way toward the circular economy
Reconomy is bending the edges of linear business models across the world, integrating circular economy strategies and processes into everyday operations. We have the tools, talent and technology that enable customers to harness the full and inherent value of their resources, with integrated global operations in over 80 countries across the world.
Reconomy’s full range of capabilities are organized into 3 ‘loops’: Recycle, Comply and Re-use, each providing opportunities for circularity within the wider resource cycle.
- Recycle loop is utilising the latest technology and data to enable customers to make the best possible use of their materials.
- Comply loop is enabling customers to solve increasingly complex environmental regulatory challenges using data, expert knowledge and thought leadership to drive business accountability across the globe.
- Re-use loop is providing intelligent technology platforms and agile delivery models for pre-retail logistics and product returns, fulfilment and processing, on behalf of many of Europe’s largest retailers.
About the role
We are looking for an experienced and proactive Senior Security Operations Analyst to join Reconomy's Information Security team in Romania.
In this role, you will provide technical leadership in complex security incident investigations, drive excellence in incident management and response, and continuously improve our security detection capabilities. You will take ownership of the post-incident feedback process, identifying detection, visibility and control gaps and translating findings into actionable requirements for Security Engineering.
Working closely with the Cyber Security Engineer, technical teams and business stakeholders, you will lead incident response efforts, conduct proactive threat hunting and help strengthen our security operations through Microsoft Sentinel, KQL and the MITRE ATT&CK framework. You will also mentor Security Operations Analysts, act as a senior technical escalation point and contribute to the continuous development of our security operations capabilities.
This is an exciting opportunity to take on a senior technical leadership role within an international, technology-driven organisation operating in more than 80 countries, with opportunities for professional growth and career progression into technical specialist or management roles.
Advanced Incident Management & Response
- Lead complex security incident investigations, applying industry-standard incident management frameworks (NIST, SANS).
- Oversee the end-to-end incident lifecycle, from detection and investigation to containment, remediation and lessons learned.
- Coordinate cross-functional incident response efforts during major security events, providing technical guidance and risk-based recommendations.
- Lead post-incident reviews, conduct root cause analysis and ensure lessons learned are implemented and tracked to closure.
Detection Gap Analysis & Continuous Improvement
- Analyse security incidents to identify detection, visibility and control gaps, translating findings into prioritised detection requirements for the Cyber Security Engineer.
- Map detection use cases to the MITRE ATT&CK framework and identify opportunities to improve threat coverage.
- Develop and maintain KQL queries for security investigations, threat hunting and detection gap analysis.
- Collaborate with Security Engineering to prioritise detection improvements, identify telemetry gaps and validate new or updated detections.
- Drive improvements in detection accuracy, incident response effectiveness and security operations processes.
Technical Leadership & Threat Hunting
- Act as the senior technical escalation point for Security Operations Analysts during complex investigations and critical security incidents.
- Conduct proactive threat hunting using Microsoft Sentinel, SIEM platforms and other security tools.
- Apply threat intelligence and incident analysis to enhance monitoring and detection capabilities.
- Identify opportunities for security automation and collaborate with Security Engineering to define response automation requirements.
Team Leadership & Mentoring
- Act as shift leader and senior point of contact during assigned periods, coordinating team activities during major incidents.
- Mentor and support Security Operations Analysts and Junior Analysts in investigation techniques, incident handling and response best practices.
- Ensure high-quality shift handovers, incident documentation and investigation standards.
- Support team development through training, knowledge sharing and constructive feedback.
Process Improvement & Knowledge Development
- Develop and maintain incident response playbooks, detection requirement specifications and investigation procedures.
- Create training materials and maintain the team's knowledge base, promoting security operations best practices.
- Contribute to security architecture discussions, tooling decisions and continuous improvement initiatives.
Stakeholder Management & Reporting
- Provide clear and timely updates to management and stakeholders on significant security incidents, emerging threats, detection coverage and lessons learned.
- Coordinate with internal teams, external security partners and vendors to support effective incident resolution.
- Represent Security Operations in operational forums, security governance meetings and technology initiatives.
- Deliver incident reports and performance metrics, communicating complex technical issues effectively to both technical and non-technical audiences.
What we need from you
Essential requirements
- 5+ years of experience in Security Operations, with a strong focus on incident management, investigation and response.
- Hands-on experience with SIEM platforms, preferably Microsoft Sentinel, including investigations, threat hunting and workbooks.
- Strong proficiency in KQL (Kusto Query Language) for security investigations, threat hunting and detection gap analysis.
- Proven experience leading complex security incident investigations and coordinating cross-functional incident response efforts.
- Solid understanding of incident management frameworks and best practices, including NIST, SANS and ITIL.
- Experience conducting post-incident reviews and translating findings into detection or security control improvements.
- Strong understanding of cyber threats, attack techniques, threat actors and TTPs, including the MITRE ATT&CK framework.
- Experience with security monitoring, threat detection, log analysis and correlation across multiple data sources.
- Hands-on knowledge of security technologies, including EDR, firewalls, IDS/IPS and SIEM platforms.
- Understanding of network protocols, operating systems and security architecture.
- Basic scripting and automation skills using PowerShell or Python.
- Experience with ISO 27001 and SOC 2 compliance frameworks.
- Previous experience in technical leadership or mentoring within a 24/7 operational environment.
- Strong analytical, problem-solving and communication skills, with the ability to make decisions under pressure and communicate complex technical issues to non-technical stakeholders.
- Bachelor's degree in Cybersecurity, Computer Science, IT or a related field, or equivalent professional experience.
- Relevant professional security certification, such as GCIH, CompTIA CySA+, CISSP or an equivalent recognised certification.
- Availability to provide rotational on-call escalation support, work irregular hours during major security incidents and collaborate with global teams across different time zones.
Nice to have
- Experience across multiple security domains, including incident response, threat hunting, digital forensics and security architecture.
- Experience with additional SIEM platforms such as Splunk, IBM QRadar or Elastic.
- Knowledge of cloud security monitoring across Azure, AWS and Microsoft 365.
- Experience with detection engineering, including SIEM analytics rule development, detection-as-code and MITRE ATT&CK coverage mapping.
- Familiarity with SOAR platforms, security orchestration and automation workflows, including Microsoft Sentinel playbooks, Logic Apps and Azure Automation.
- Experience with threat intelligence platforms, proactive threat hunting methodologies and security tool implementation or optimisation.
- Knowledge of malware analysis, network forensics and packet analysis tools such as Wireshark.
- Advanced scripting, automation and integration skills, or experience with reporting tools such as Power BI.
- Exposure to red team/purple team exercises and security transformation projects.
- Additional certifications such as Microsoft SC-200, GCFA, GREM, GNFA, CISM, CEH or relevant SANS and cloud security certifications.
- Master's degree in Cybersecurity or a related field.
What we offer
- International & Collaborative Environment: Join a friendly, diverse and international team of colleagues who share your passion for innovation, agile working and professional growth, while contributing to the exciting and dynamic field of Reverse Logistics.
- Hybrid Working: Enjoy the flexibility of a hybrid working environment, subject to the operational requirements of the role and its 24/7 shift schedule.
- Learning & Development: Benefit from continuous training and development opportunities, stay up to date with the latest technologies and enhance your expertise in cybersecurity and IT operations.
- Competitive Compensation: Receive a competitive salary and additional benefits, including extra compensation for working unsociable hours as part of the 24/7 shift rotation.
- Modern Office: Work in a welcoming, comfortable office conveniently located near Bucharest's city centre and designed to make you feel at home.
- Time Off & Volunteering: Enjoy 23 working days of annual leave, 2 additional days for volunteering activities and an extra day off to celebrate your birthday.
- Meal Vouchers: Receive meal vouchers worth 45 RON per working day, taxed in accordance with current legislation.
- Private Healthcare: Benefit from a private medical subscription with Medicover.
